Windows 10: windowsudk.shellcommon.dll is causing explorer.exe to not be able to start at all

this is what I get in the event viewer:Faulting application name: explorer.exe, version: 10.0.22621.4169, time stamp: 0xdf363a33Faulting module name: windowsudk.shellcommon.dll, version: 10.0.22621.4169, time stamp: 0xbe7c5652Exception code: 0xc0000005Fault offset: 0x0000000000080568Faulting process id: 0x0x820Faulting application start time: 0x0x1DB118A17B27CBEFaulting application path: C:\windows\explorer.exeFaulting module path:

:)

 

UT3.EXE Kernel32.DLL error

Kernell32.dll is not the piece being shut down, it is UT3.EXE with mod name kernel32.dll.

 

When does the Operating system verify the Authenticode Signatures for signed EXEs and signed DLLs?

When PE Files (exes, dlls etc.) are code signed using signtool, they can be verified to check if they have been authored by trusted publishers. In which scenarios does the Operating system actually verify signed EXEs and DLLs?

1. Are signatures of EXEs verified every time they are run?
2. If an EXE has a dynamically linked DLL, is the DLL's signature verified when the EXE is run?
   
3. If the EXE dynamically loads a DLL using LoadLibrary, is the DLL's signature verified when the EXE is run?
4. When an EXE requires elevated privilege (UAC), is the signature of the EXE and the DLL dependencies verified as well? (1-3)

If this questions belongs in a different category or community, please let me know. Thanks.

 

Known DLLs causing crash in ntdll.dll and regsvr32.exe after Windows updates

Dear Community,

We produce radio automation software that uses a set of DLL libraries for various audio related tasks such as audio file creation, recording and editing. These are:

NCTAudioCDGrabber2.dll

NCTAudioCompress2.dll

NCTAudioEditor2.dll

NCTAudioFile2.dll

NCTAudioInformation2.dll

NCTAudioPlayer2.dll

NCTAudioRecord2.dll

NCTAudioTransform2.dll

NCTAudioVisualization2.dll

NCTAudioVisualizationEx2.dll

We have bought these libraries and used them without any incident so far. But since a couple of days, we get reports of our software crashing hard (without any message) on startup. The crash can be routed back to ntdll.dll (details below). After investigation it seems that the above listed NCT* DLLs cause the crash in ntdll.dll after recent Windows Updates. When the NCT* DLLs are removed from the system, no hard crash occurs but instead logically an error message is shown indicating the missing DLLs.

On trying te remedy the issue, we noticed that regsvr32.exe (the 32 bit version in SysWow64) also crashes when trying to manually re-register the DLLs. Also after manually cleaning the register for previous entries for these DLLs. The crash of regsvr32.exe occurs on trying to register any of the NCT* DLLs individually.

We tried all obvious steps such as re-installation, manual re-registration, manual cleanup, replacing the NCT* DLLs manually with known correct and intact versions, etc.

We now have several reports from multiple customers where this issue occurs. We hope somebody in the community can shine some light on this issue.

Any help with this issue would be much appreciated. Thanks you!

Details from the Windows Application logbook:

Crash in ntdll.dll, Event Data:

Zenlex_BS_C.exe (our application, a 32 bit application)

1.57.0.6

63884dc2

ntdll.dll

10.0.19041.3155

2daa62a8

c0000005

0003ff25

3608

01d9c454a02bc57f

C:\Zenlex\Zenlex RM\Zenlex_BS_C.exe

C:\Windows\SYSTEM32\ntdll.dll

fd603429-c862-4401-8a8e-1d97be10cc3c

Crash in regsvr32.dll (the 32 bit version), Event Data:

regsvr32.exe

10.0.19041.1

02a48164

unknown

0.0.0.0

00000000

c00001a5

0451a84a

27d0

01d9c4557d3ba51c

C:\Windows\SysWOW64\regsvr32.exe

unknown

9f164792-1125-4207-85b5-14d79ece6353

Microsoft Windows Updates placed on July 27th 2023, since when the issue occurs:

Update for Microsoft Windows (KB5028015)

Update for Microsoft Windows (KB5011064)

Update for Microsoft Windows (KB5028244)

Update for Microsoft Windows (KB5011048)

Update for Microsoft Windows (KB5028013)

Servicing Stack 10.0.19041.3266

Servicing Stack 10.0.19041.3205